Terms of Service

Version 1.0
Effective Date: August 11, 2026
Last Updated: August 11, 2026

4StudentLives, Inc. · 1967 E Sunshine Trl · Saint George, Utah 84790-1919 · legal@4studentlives.com

TABLE OF CONTENTS

PLEASE READ THESE TERMS CAREFULLY BEFORE EXECUTING AN ORDER FORM OR ACCESSING THE SERVICE. These Terms of Service (the “Terms”) form a binding commercial agreement between 4StudentLives, Inc., a Delaware corporation (“4StudentLives”), and the educational organization identified on an Order Form (“Customer”). This Agreement is not an agreement with any Authorized User, student, parent, or guardian, and no individual acquires rights under it.

Customer is urged to review with care Article 8; Article 13, which imposes a mandatory human-review obligation; Article 28; Article 30; and Article 31, which requires most disputes to be arbitrated individually and waives jury trial and class participation. Many Customers are public entities whose authority to agree to certain terms is constrained by state law; public-entity accommodations are stated throughout these Terms. The Service is a documentation, coordination, and recordkeeping tool for trained professionals. It is not an emergency notification system, a crisis hotline, a medical device, or a substitute for professional clinical, educational, or law enforcement judgment. In an emergency, call 911.

ARTICLE 1. DEFINITIONS

1.1 Construction

Defined terms are capitalized wherever they appear; the singular includes the plural; “including” means “including without limitation”; “days” are calendar days unless business days are stated; a reference to a statute includes its implementing rules and successor provisions; and no rule of construction against the drafter applies.

1.2 Defined Terms

“Acceptable Use Policy” or “AUP” means the 4StudentLives Acceptable Use Policy, incorporated by reference.

“Affiliate” means an entity controlling, controlled by, or under common control with a party and, as to Customer, any subordinate school or educational agency identified on an Order Form.

“Aggregated De-Identified Data” means data derived from Customer Data and de-identified to the standard in Article 9.

“Agreement” means these Terms with all Order Forms, addenda, exhibits, and incorporated policies, including the Privacy Policy, the AUP, the AI Policy, and any executed Data Privacy Agreement.

“AI Features” means Service functions using machine learning or generative artificial intelligence to assist Authorized Users, including summarization, optical character recognition (“OCR”), and drafting assistance.

“AI Output” means any material generated by AI Features.

“AI Policy” means the 4StudentLives AI Usage & Human Review Policy, incorporated by reference.

“Applicable Law” means the federal, state, and local law of the United States applicable to a party’s performance, including FERPA, PPRA, COPPA, IDEA, and state student data privacy statutes.

“Audit Logs” means Service records of authentication, access, modification, deletion, and export events, with user identifier and timestamp.

“Authorized User” means an individual acting under Customer’s authority whom Customer provisions with credentials to access the Service.

“Authorized User Credentials” means the credentials, authentication factors, tokens, and recovery codes issued to or established by an Authorized User.

“Confidential Information” has the meaning given in Article 25; Customer Data is Customer’s Confidential Information.

“Customer” means the educational organization identified on the applicable Order Form.

“Customer Administrator” means an Authorized User with elevated privileges to provision accounts, configure permissions, and access Audit Logs.

“Customer Data” means all data, records, files, and other content submitted to or generated within the Service by or on behalf of Customer or its Authorized Users, including Student Data and AI Output.

“Data Privacy Agreement” means a student data privacy addendum executed by both parties, including a National Data Privacy Agreement (“NDPA”) or Student Data Privacy Consortium (“SDPC”) exhibit or a state-mandated addendum.

“Documentation” means the guides, help center content, release notes, and technical documentation 4StudentLives makes generally available for the Service.

“Education Records” means education records as defined in FERPA at 34 C.F.R. § 99.3.

“Effective Date” means the earlier of Customer’s first execution of an Order Form and its first access to the Service.

“Fees” means the subscription, Professional Services, and other charges stated on an Order Form, exclusive of Taxes.

“FERPA” means the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and its implementing regulations at 34 C.F.R. Part 99.

“Initial Term” and “Renewal Term” have the meanings given in Article 26.

“Malicious Code” means viruses, worms, ransomware, and other code intended or likely to harm, disable, or permit unauthorized access to software, hardware, networks, or data.

“Order Form” means an ordering document, quote, statement of work, or online order referencing the Agreement and executed by both parties, identifying the modules licensed, quantities, the Term, and the Fees.

“Personal Information” means information identifying or reasonably capable of being associated with an identifiable individual.

“Privacy Policy” means the 4StudentLives Privacy Policy, incorporated by reference.

“Professional Services” means implementation, configuration, data migration, integration, training, and similar services described on an Order Form or statement of work.

“Security Incident” means a confirmed unauthorized access to, acquisition of, disclosure of, or destruction of Customer Data in 4StudentLives’ control; unsuccessful events such as port scans and denied logins are not Security Incidents.

“Service” means the 4StudentLives multi-tenant software-as-a-service platform at 4studentlives.com, including all applications, application programming interfaces, and Documentation, and the Behavioral Threat Assessment, Suicide Risk Assessment, Student Profile, Student Safety Plan, Follow-up Task, Case Management, File Storage, Audit Log, notification, and AI Features modules Customer licenses.

“Service Data” means technical and operational metadata 4StudentLives generates in operating, securing, supporting, and improving the Service, excluding Customer Data and all Student Data.

“Student Data” means Personal Information relating to a student that is collected or maintained in the Service, including Education Records.

“Subprocessor” means a third party engaged by 4StudentLives to process Customer Data in providing the Service.

“Support” means the technical support services described in Article 15.

“Taxes” means sales, use, excise, and similar transaction-based taxes imposed on the Fees, excluding taxes on 4StudentLives’ net income or property.

“Term” means the subscription period stated in the applicable Order Form, including all renewal periods.

“Third-Party Services” means software, integrations, data feeds, or services not part of the Service and provided by another party.

“Uptime” means the percentage of minutes in a calendar month during which the Service is available to Authorized Users, calculated as described in Article 15.

ARTICLE 2. ACCEPTANCE OF THE AGREEMENT; STRUCTURE AND ORDER OF PRECEDENCE

2.1 Formation and Authority

The Agreement forms on the earliest of Customer’s execution of an Order Form referencing these Terms, first access to the Service, or payment of an invoice. The individual causing formation represents that he or she is at least eighteen (18) years of age and holds full authority to bind Customer, including any board approval Applicable Law requires.

2.2 Order of Precedence; No Purchase Order Terms; Affiliates

In descending order of precedence the Agreement comprises an executed Data Privacy Agreement (as to Student Data and Education Records); an executed Order Form; these Terms; the Privacy Policy, Acceptable Use Policy, and AI Usage & Human Review Policy, each incorporated by reference and compliance with which is a condition of use; and the Documentation. Preprinted, click-through, or vendor-portal terms transmitted with a Customer purchase order or requisition are expressly rejected and of no effect; only the ordering entity, quantities, Term, Fees, and remittance instructions are given effect. Where an Order Form so provides, Customer’s Affiliates and participating member districts may access the Service under Customer’s subscription; Customer is responsible for their acts and omissions and remains primarily liable for all Fees.

ARTICLE 3. ELIGIBILITY

3.1 Institutional Customers Only

The Service is offered solely to educational organizations and comparable institutions maintaining Education Records in the ordinary course, and is offered in and operated from the United States. Customer shall not permit access from outside the United States without 4StudentLives’ prior written consent and is solely responsible for any non-United States data protection or export control law its conduct implicates; the Service is not offered subject to the European Union or United Kingdom General Data Protection Regulation. No individual may hold an account in a personal capacity, and students do not register for, hold, or access accounts; the Service shall not be resold or made available to the general public.

3.2 Representations; Suspension for Ineligibility

Customer represents throughout the Term that it is an entity described in Section 3.1, is legally authorized to maintain the Education Records it submits, and will use the Service only for its own internal educational and student safety purposes; and that each Authorized User is at least eighteen (18) years of age (or a lawfully employed individual at least sixteen (16) years of age acting under supervision), acts under Customer’s authority, has a legitimate educational interest determined by Customer under Article 7, and has been directed to comply with the AUP and the AI Policy. If 4StudentLives determines in good faith that Customer or a purported Authorized User is ineligible, it may suspend access under Article 27 and, if not cured within thirty (30) days of written notice, terminate under Article 26.

ARTICLE 4. ACCOUNTS AND ACCOUNT PROVISIONING

4.1 Provisioning; Credentials; Multi-Factor Authentication

All accounts are provisioned and deprovisioned exclusively by Customer Administrators; there is no self-service registration. Customer shall maintain at least two (2) Customer Administrators and limit their number to the minimum necessary; credentials are issued to a single identified natural person. Customer shall not create, permit, or tolerate shared, generic, group, or anonymous accounts or permit credential sharing, which is a material breach. A single break-glass administrative credential is permitted where vaulted, protected by multi-factor authentication (“MFA”), used only in a documented emergency, and logged. 4StudentLives requires MFA for all Customer Administrator accounts and strongly recommends MFA for all other Authorized Users; if Customer does not enforce MFA tenant-wide, 4StudentLives shall have no liability for unauthorized access that enforcement would have prevented. 4StudentLives may, on not less than thirty (30) days’ notice, make MFA mandatory.

4.2 Deprovisioning; Responsibility; Compromise

Customer shall deprovision or suspend an Authorized User’s access promptly, and in no event later than one (1) business day, upon separation, role change eliminating a legitimate educational interest, or discovery of a violation of the AUP, the AI Policy, or Applicable Law. Customer is responsible for all activity under its accounts, whether or not authorized, except to the extent it results directly from 4StudentLives’ breach of Article 14, and shall notify legal@4studentlives.com within twenty-four (24) hours of becoming aware of any actual or suspected unauthorized access or credential compromise. Customer shall keep its contact information current.

ARTICLE 5. AUTHORIZED USERS

5.1 Permitted Population; Legitimate Educational Interest

Authorized Users are limited to individuals for whom access to student safety casework is a function of their job duties — including administrators, counselors, nurses (consistent with Article 12), and members of Customer’s assessment and crisis teams — with permissions limited to what those duties require. Customer shall grant access only where it has determined that the individual has a legitimate educational interest in the Education Records to which the access extends, as that concept is used at 34 C.F.R. § 99.31(a)(1)(i)(A). Whether a sworn officer’s records are law enforcement unit records under 34 C.F.R. § 99.8 is a determination for Customer alone.

5.2 Training; Liability; Guardian Access

Customer shall ensure each Authorized User, before access and at least annually thereafter, is trained on obligations under FERPA and state law, the AUP, and the AI Policy and the mandatory human review obligation in Article 13. Nothing in the Service or any AI Output relieves an Authorized User of a mandatory reporting obligation, a duty to warn or protect, or any comparable professional duty. Customer is responsible and liable for the acts and omissions of its Authorized Users as if they were Customer’s own. Parents and guardians do not hold accounts by default; where Customer grants a parent or legal guardian access, that individual is provisioned as an Authorized User with permissions scoped strictly to records concerning his or her own child, and Customer alone verifies identity and legal status, determines whether disclosure is permitted under FERPA and 34 C.F.R. § 99.4, and revokes access on any change in status; such access is not compliance with Customer’s obligation to afford inspection and review under 34 C.F.R. §§ 99.10 through 99.12. Customer shall not exceed the licensed quantity stated on the Order Form; on excess the parties will execute an Order Form at then-current rates.

ARTICLE 6. CUSTOMER RESPONSIBILITIES

6.1 Customer Obligations

Customer shall use the Service in accordance with the Agreement, the AUP, the AI Policy, and Applicable Law, and is solely responsible: for the accuracy, legality, and appropriateness of Customer Data; for all rights, lawful bases, notices, and consents necessary for its collection, disclosure, and processing, including every notice FERPA, PPRA, and state student data privacy law require; for configuring role-based access controls on a least-privilege basis; for reviewing Audit Logs and for the record of disclosures under 34 C.F.R. § 99.32; for a documented review of all accounts, roles, and permissions at least twice per twelve (12) month period; for securing the devices, networks, and identity infrastructure used to access the Service; for designating and keeping current administrative, billing, security, and privacy contacts, the security contact being available on a twenty-four (24) hour basis and notice to a designated contact being notice to Customer; and for its own records retention, public records, litigation hold, and audit requirements.

6.2 Effect of Non-Performance; Prohibited Uses

Customer’s performance of this Article and Article 7 is a condition of 4StudentLives’ obligations, and 4StudentLives is not liable for any deficiency in the Service, inaccuracy in AI Output, or harm to any person to the extent caused by Customer’s failure to perform them; where that failure prevents or delays performance, 4StudentLives is excused from the affected obligation. Customer shall not use the Service to store data unrelated to student safety casework, to conduct surveillance unrelated to a documented safety concern, to store protected health information in violation of Article 12, or to make any decision inconsistent with Article 13.

ARTICLE 7. EDUCATIONAL ORGANIZATION RESPONSIBILITIES

7.1 School Official Designation

Customer is the educational agency or institution that maintains the Education Records stored in the Service and retains full control over and legal responsibility for them. Customer hereby designates 4StudentLives, and each of its personnel and Subprocessors with access to Customer Data, as a “school official” with a “legitimate educational interest” in Education Records within the meaning of 34 C.F.R. § 99.31(a)(1)(i)(B). Customer represents that its annual notification of rights under 34 C.F.R. § 99.7 specifies criteria for school-official status that include outside service providers; that 4StudentLives performs a function for which Customer would otherwise use employees under 34 C.F.R. § 99.31(a)(1)(i)(B)(1); that 4StudentLives is under Customer’s direct control as to the use and maintenance of Education Records under 34 C.F.R. § 99.31(a)(1)(i)(B)(2); and that 4StudentLives is subject to 34 C.F.R. § 99.33(a) as required by 34 C.F.R. § 99.31(a)(1)(i)(B)(3). Customer, and not 4StudentLives, determines which individuals have a legitimate educational interest in which records, consistent with 34 C.F.R. § 99.31(a)(1)(ii).

7.2 Parent and Eligible Student Rights; Directory Information

Customer is solely responsible for responding to requests by parents and eligible students to inspect and review Education Records under 34 C.F.R. §§ 99.10 through 99.12 and to seek amendment under 34 C.F.R. §§ 99.20 through 99.22, including the hearing obligation under 34 C.F.R. § 99.21. 4StudentLives will not respond substantively, will refer the requester and any complaint to Customer’s privacy contact within five (5) business days, and on request will provide reasonable assistance at no additional charge, including human-readable records and implementation of corrections or deletions Customer directs. Complaints alleging a FERPA violation are adjudicated by the U.S. Department of Education’s Student Privacy Policy Office under 34 C.F.R. §§ 99.63 through 99.67, in which Customer is the responsible party. Customer alone determines whether to designate directory information under 34 C.F.R. § 99.37; 4StudentLives makes no directory information disclosure and treats all Student Data as non-directory personally identifiable information.

7.3 State Law; Legal Process; Policies

Customer is responsible for its own compliance with the student data privacy statutes of the states in which it operates, and where Applicable Law requires a specific written agreement between an educational agency and an operator or third-party contractor the parties shall execute a Data Privacy Agreement. Customer is solely responsible for any public contract listing, parents’ bill of rights for data privacy and security, or advance notice to parents that Applicable Law requires; on request 4StudentLives will supply the descriptive information Customer reasonably needs. Customer is responsible for responding to legal process seeking Education Records, including any obligation under 34 C.F.R. § 99.31(a)(9) to notify the parent or eligible student in advance; if 4StudentLives receives such process it will, unless legally prohibited, promptly notify Customer’s privacy contact, cooperate at Customer’s expense in any effort to quash or narrow, and disclose only the minimum compelled. Selection of an assessment framework is Customer’s alone.

ARTICLE 8. LICENSE GRANT AND LICENSE RESTRICTIONS

8.1 License Grant

Subject to Customer’s compliance with the Agreement and payment of the Fees, 4StudentLives grants Customer, during the Term, a limited, non-exclusive, non-transferable, non-sublicensable, revocable right to access and use the Service and the Documentation solely for Customer’s internal educational, student safety, and administrative purposes, by and through its Authorized Users, within the limits stated on the applicable Order Form. Customer may reproduce the Documentation internally without removing any proprietary notice. Additional modules, users, or capacity require an executed Order Form. All rights not expressly granted are reserved.

8.2 License Restrictions

Customer shall not, and shall not permit any Authorized User, Affiliate, or third party to: reverse engineer, decompile, or attempt to derive the Service’s source code, algorithms, models, or prompts, except where Applicable Law prohibits this restriction and then only after thirty (30) days’ notice; copy, modify, or create derivative works of the Service or Documentation; use any robot, script, or crawler to extract content other than through a provided application programming interface; develop a competing offering or permit access by a competitor’s personnel; perform any penetration test, vulnerability scan, denial-of-service, or social engineering test without 4StudentLives’ prior written authorization and a mutually agreed rules-of-engagement document; circumvent any rate limit, authentication mechanism, or MFA requirement; use the Service, Customer Data, or AI Output to train, fine-tune, or otherwise develop any machine learning model, algorithm, risk score, or predictive or classification system; resell, lease, sublicense, time-share, or operate the Service as a service bureau, or make it available to any third party except as Article 2 permits; introduce Malicious Code; impose a disproportionate load on the multi-tenant environment; attempt to access any tenant, account, or record Customer is not authorized to access; use the Service unlawfully or in violation of any person’s intellectual property or privacy rights; use the Service in any high-risk application in which its failure could lead directly to death or personal injury, including as a component of a medical device, emergency dispatch system, or life-safety system; or knowingly permit any third party to do any of the foregoing.

8.3 Trials and Betas; Verification; Effect of Breach

Trial, pilot, beta, and preview features are provided AS IS and AS AVAILABLE, are excluded from the availability commitment in Article 15 and from any warranty, and may be modified or discontinued at any time without liability; Customer shall not place production Student Data into a non-production environment unless 4StudentLives confirms in writing that it is subject to the safeguards in Article 14. Customer’s breach of Section 8.2 is a material breach, may cause irreparable harm for which monetary damages are inadequate, and entitles 4StudentLives to seek injunctive relief under Article 31, suspension under Article 27, and termination under Article 26.

ARTICLE 9. OWNERSHIP AND INTELLECTUAL PROPERTY

9.1 Ownership; Trademarks

As between the parties, 4StudentLives and its licensors own all right, title, and interest, including all patent, copyright, trademark, and trade secret rights, in and to the Service and the software, code, and designs comprising it; the Documentation; all templates 4StudentLives supplies; all prompts and integration logic used to implement AI Features; all Service Data and Aggregated De-Identified Data; all improvements and derivative works of the foregoing; and the 4StudentLives name and marks. The Service is licensed, not sold, and no license is granted by implication or estoppel. As between the parties, Customer owns all right, title, and interest in and to Customer Data, including all Student Data and Education Records contained in it and all AI Output derived from Customer Data. 4StudentLives acquires no license other than that granted in Article 10, acts solely as a service provider processing Customer Data on Customer’s documented instructions, and shall not assert any lien or security interest against Customer Data, including for non-payment of Fees. Customer owns the content of any custom form, template, or workflow it authors. Third-party infringement claims are governed by Article 29.

9.2 Service Data and Aggregated De-Identified Data

4StudentLives owns Service Data and may use it to operate, secure, support, meter, invoice for, and improve the Service, to detect fraud and Security Incidents, and to satisfy audit and legal obligations. 4StudentLives shall not extract into Service Data the substantive content of any assessment, plan, narrative, uploaded file, or student record, and Service Data includes no Student Data. 4StudentLives may create and use Aggregated De-Identified Data for research, product development, and publication of aggregate industry trends, subject to the following: all direct identifiers, and all quasi-identifiers that could reasonably permit identification, are removed or generalized; no student-level, case-level, or record-level data is retained; no statistic is released unless computed from a cell of at least ten (10) individuals; 4StudentLives shall neither attempt nor assist re-identification; and de-identification shall be performed consistently with 34 C.F.R. § 99.31(b). Data satisfying this Section is not Personal Information, Student Data, or an Education Record.

ARTICLE 10. CUSTOMER DATA

10.1 Limited License; Prohibited Uses

Customer grants 4StudentLives and its Subprocessors a limited, non-exclusive, royalty-free right, during the Term and the post-termination periods described in Article 17, to host, store, transmit, back up, and otherwise process Customer Data solely to provide, maintain, secure, and support the Service for Customer; to perform the processing an Authorized User initiates, including by AI Features under Article 13; to address technical problems and Security Incidents; to perform Professional Services Customer has ordered; and to comply with Customer’s documented instructions and Applicable Law. This license confers no ownership interest and terminates as provided in Article 17. 4StudentLives shall not, and shall contractually prohibit its Subprocessors from: selling, renting, or otherwise disclosing Customer Data or Student Data for monetary or other valuable consideration; using Customer Data for targeted or behavioral advertising, for a marketing profile, or for any commercial purpose unrelated to providing the Service; using Customer Data to train, fine-tune, or otherwise develop or improve any general-purpose, foundation, or third-party machine learning model; using Customer Data to build a profile of a student for any purpose other than providing the Service; redisclosing Customer Data except as Customer directs, as the Agreement expressly permits, or as required by law consistent with Article 7; or retaining Customer Data beyond the periods stated in Article 17.

10.2 Content Responsibility; No Monitoring; Support Access

Customer is solely responsible for the content of Customer Data. 4StudentLives does not pre-screen, monitor, or moderate Customer Data and does not access its content in the ordinary course. However, if 4StudentLives receives credible notice or obtains actual knowledge that Customer Data violates Applicable Law, infringes a third party’s rights, contains Malicious Code, or materially violates the AUP, it may investigate and may remove, disable access to, or quarantine the specific content and may suspend access under Article 27, notifying Customer beforehand except where prohibited by law or where an exigent risk exists. 4StudentLives personnel will not access the content of Customer Data within Customer’s tenant for support or troubleshooting except with Customer’s authorization, or where necessary to preserve the security, integrity, or availability of the Service or to respond to a Security Incident, in which case it will act on a minimum-necessary basis and will notify Customer’s security contact promptly. Authorized support access is time-limited, scoped, logged, and revocable at any time. Customer’s documented instructions consist of the Agreement, its configuration choices, the actions its Authorized Users take, and written instructions delivered to legal@4studentlives.com.

ARTICLE 11. FERPA AND STUDENT DATA PRIVACY

11.1 School Official Status; Limits on Use and Redisclosure

4StudentLives accepts its designation under Article 7 as a school official with a legitimate educational interest under 34 C.F.R. § 99.31(a)(1)(i)(B), and shall use Education Records only to perform the institutional services described in the Agreement, maintain them under Customer’s direct control, permit access only by personnel and Subprocessors with a need to access them, and implement Customer’s directions regarding correction and deletion. Consistent with 34 C.F.R. § 99.33(a), 4StudentLives shall not use personally identifiable information from Education Records for any purpose other than that for which the disclosure was made, and shall not redisclose it to any other party without Customer’s prior written authorization, except to a Subprocessor identified in Section 11.2, as required by law, or as Customer directs. 4StudentLives shall inform any recipient of an authorized redisclosure that the information may not be further redisclosed, consistent with 34 C.F.R. § 99.33(a)(2), and will provide Customer the information necessary to maintain any record of disclosure required under 34 C.F.R. § 99.32.

11.2 Subprocessors and Pass-Through

4StudentLives engages the following Subprocessors, each located in the United States:

4StudentLives shall bind each Subprocessor by written agreement to obligations no less protective than those in Articles 10, 11, 14, and 25; remain fully responsible for its acts and omissions; and give Customer at least thirty (30) days’ advance notice before adding or replacing a Subprocessor that will process Customer Data, during which Customer may object under the process in Article 23.

11.3 No Sale; No Advertising; No Profiling; Cooperation

4StudentLives does not sell Student Data or any Customer Data; does not use Student Data for targeted or behavioral advertising or advertising profiles; does not amass a profile of a student except in furtherance of the educational purposes Customer authorizes; and does not use Student Data for any commercial purpose unrelated to providing the Service. These commitments survive termination. On reasonable written notice and not more than once in any twelve (12) month period, 4StudentLives will provide a completed security questionnaire, Higher Education Community Vendor Assessment Toolkit (HECVAT), or comparable assessment and summary results of the most recent independent penetration test, and will cooperate with an audit or investigation by the U.S. Department of Education, a state education agency, or a state attorney general. Information so furnished is 4StudentLives’ Confidential Information under Article 25.

11.4 State Statutes; PPRA; COPPA; IDEA; Precedence

4StudentLives will comply, as applicable to its role, with the vendor, operator, and third-party-contractor obligations of California’s Student Online Personal Information Protection Act, Cal. Bus. & Prof. Code §§ 22584–22585 (“SOPIPA”), and California Education Code § 49073.1 (AB 1584); New York Education Law § 2-d and 8 N.Y.C.R.R. Part 121; Illinois’ Student Online Personal Protection Act, 105 ILCS 85/ (“SOPPA”); the Colorado Student Data Transparency and Security Act, Colo. Rev. Stat. §§ 22-16-101 et seq.; Connecticut Public Act 16-189, codified at Conn. Gen. Stat. §§ 10-234aa et seq.; and the Utah Student Data Protection Act, Utah Code Ann. §§ 53E-9-301 et seq. The Protection of Pupil Rights Amendment, 20 U.S.C. § 1232h, restricts surveys and evaluations revealing protected categories; 4StudentLives administers none, and Customer is solely responsible for PPRA compliance. The Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and 16 C.F.R. Part 312 apply to services directed to children under thirteen (13); the Service is not directed to children, has no student-facing interface, and collects no Personal Information directly from any student. Records concerning a student with a disability are subject to the confidentiality provisions of the Individuals with Disabilities Education Act, 20 U.S.C. § 1417(c), and 34 C.F.R. §§ 300.610 through 300.627 in addition to FERPA; Customer remains responsible for destruction of information no longer needed under 34 C.F.R. § 300.624 and the record of access required by 34 C.F.R. § 300.614. Where the parties execute a Data Privacy Agreement, NDPA or SDPC exhibit, or state-mandated addendum, that instrument controls over these Terms to the extent of a conflict concerning Student Data or Education Records; absent such an instrument, this Article 11 governs.

ARTICLE 12. HIPAA DISCLAIMER AND PROTECTED HEALTH INFORMATION

12.1 The Service Is Not Offered for PHI; The FERPA Carve-Out

The Service is not offered for the receipt, storage, transmission, or processing of protected health information (“PHI”) regulated by the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act, together with their implementing regulations at 45 C.F.R. Parts 160 and 164 (collectively, “HIPAA”), unless the parties execute a separate written business associate agreement (“BAA”). Absent an executed BAA, 4StudentLives is not a business associate, and no course of dealing or purchase order creates that relationship; an executed BAA will control over this Article as to PHI. HIPAA’s definition of PHI at 45 C.F.R. § 160.103 expressly excludes education records covered by FERPA, 20 U.S.C. § 1232g; records described at 20 U.S.C. § 1232g(a)(4)(B)(iv); and employment records. Consequently most health-related information a K–12 school maintains about a student — nurse visit notes, immunization records, counseling notes, and information recorded in a Suicide Risk Assessment or Student Safety Plan — is an education record governed by FERPA and Article 11, not PHI. The carve-out does not reach every record: a component conducting standard electronic transactions, most commonly school-based Medicaid claims, may itself be a covered health care provider under 45 C.F.R. § 160.103; a district designating itself a hybrid entity under 45 C.F.R. §§ 164.103 and 164.105 may hold PHI within that component; and records a community provider shares with Customer may carry independent restrictions, including 42 C.F.R. Part 2.

12.2 Instruction Not to Upload PHI; Consequences; Indemnity

Customer shall not, and shall instruct its Authorized Users not to, submit PHI to the Service absent an executed BAA. If PHI is submitted absent an executed BAA: 4StudentLives assumes no HIPAA obligation but will protect that information under Articles 10, 11, 14, and 25; Customer shall promptly remove it or direct deletion in writing, which 4StudentLives will complete within thirty (30) days under Article 17; and 4StudentLives may suspend the affected feature under Article 27 if the submission recurs. Customer shall defend and indemnify 4StudentLives from any third-party claim, regulatory proceeding, penalty, or expense (including reasonable attorneys’ fees) arising out of the submission of PHI absent an executed BAA, subject to the procedures and the public-entity accommodation in Article 29.

ARTICLE 13. AI FEATURES AND HUMAN REVIEW

13.1 Assistive Purpose Only; What AI Features May and May Never Do

AI Features in the Service are assistive only. They operate solely on content Authorized Users have entered or uploaded; they gather no information about students from any external source and do not surveil students. AI Features may: (a) summarize information already entered by Authorized Users or contained in files uploaded to File Storage; (b) extract machine-readable text from images and scanned documents through OCR; (c) assist with the drafting, phrasing, and organization of narrative text an Authorized User composes; (d) categorize, tag, or group information to aid navigation, search, and retrieval; and (e) interpret a natural-language query to retrieve and highlight responsive passages within records the requesting Authorized User is already authorized to access, without ranking students or surfacing any record the Authorized User is not permitted to see. AI Features never: (a) make disciplinary decisions or recommend disciplinary outcomes; (b) determine, score, assign, calculate, rank, validate, or otherwise adjudicate a threat level, risk level, risk score, or risk classification for any student; (c) make safety or intervention decisions; (d) recommend, initiate, or trigger contact with law enforcement, removal from school, suspension, expulsion, involuntary transport, hospitalization, or any other intervention; (e) replace the professional judgment of the Authorized User or of Customer’s multidisciplinary team; or (f) operate autonomously or take any action without a human in the loop. These enumerations are exhaustive statements of 4StudentLives’ design commitments, and 4StudentLives shall not introduce an AI capability inconsistent with them without Customer’s prior written consent.

13.2 Mandatory Human Review; No Automated Decision-Making

Customer and each Authorized User shall review every AI Output for accuracy, completeness, and appropriateness before relying on it, acting on it, incorporating it into a record, or disclosing it. This is a contractual obligation of Customer and not merely a recommendation. The reviewing Authorized User is professionally responsible for any record incorporating AI Output. The Service performs no automated decision-making, profiling, or risk scoring. Customer shall not, and shall ensure that no Authorized User does, use AI Output as the sole or determinative basis for any decision affecting a student, including any decision concerning discipline, threat or risk level, removal from a classroom or campus, referral to law enforcement, or the content of a Student Safety Plan. Every such decision shall be made by qualified human professionals exercising independent judgment on the underlying source information.

13.3 Configurability; No Model Training; Accuracy

Customer may disable AI Features in whole or by feature, module, school, or role, at any time and without charge; 4StudentLives will implement a written disablement request within ten (10) business days, after which content within that scope will not be transmitted to the AI Subprocessor identified in Article 11. Customer Data is not used to train, fine-tune, or improve any general-purpose model, foundation model, or any model that serves any person other than Customer. 4StudentLives has contractually directed its AI provider, Google LLC (through Google Cloud Vertex AI and the Gemini model family), not to use Customer Data to train its models and to process such content only to return a response to the requesting call; AI processing occurs in United States regions. Customer acknowledges that AI Output may be inaccurate, incomplete, outdated, or entirely fabricated — a phenomenon commonly called “hallucination” — and that OCR may misread handwriting and low-quality scans and may transpose, omit, or invent characters, numbers, dates, and names. AI Output is not professional advice; 4StudentLives disclaims all warranties with respect to AI Output as provided in Article 28, and Customer’s use of AI Output is at Customer’s sole risk.

13.4 Customer Frameworks; Transparency; Changes

Customer alone selects the threat assessment, suicide risk assessment, and crisis response frameworks it uses, such as the Comprehensive School Threat Assessment Guidelines (CSTAG), the Salem-Keizer Cascade Model, and the Columbia-Suicide Severity Rating Scale. 4StudentLives is not affiliated with, endorsed by, or validated by their authors or publishers, and does not represent that the Service implements, scores, or ensures fidelity to any of them. No AI Feature applies, scores, or interprets any framework. Content generated by AI Features is identified as AI-generated, and the Audit Logs record each invocation, the invoking Authorized User, and the time. The AI Usage & Human Review Policy supplements this Article; in the event of a conflict, this Article 13 controls. A change materially expanding the permitted categories of AI processing, altering the commitments in Section 13.1, or changing the AI Subprocessor requires notice under Article 34 and the objection process in Article 23.

ARTICLE 14. SECURITY

14.1 Security Program; Encryption; Access; Personnel; Secure Development

4StudentLives maintains a written information security program of administrative, technical, and physical safeguards; these safeguards are contractual commitments and shall not be materially diminished during the Term. Customer Data is encrypted in transit using Transport Layer Security version 1.2 or higher and at rest using AES-256 or a stronger algorithm, including uploaded files and backup media; keys are managed through Google Cloud Platform key management services and rotated on a defined schedule. Access is role-based and least-privilege; administrative access to production requires multi-factor authentication and is revoked within twenty-four (24) hours of a role change or separation. Personnel with production access undergo background screening and complete security awareness training annually. Development follows a secure software development lifecycle with peer code review, static analysis, and dependency scanning addressing the OWASP Top 10; findings are remediated critical within seven (7) days, high within thirty (30) days, and medium within ninety (90) days. 4StudentLives will engage a qualified independent third party to perform a penetration test of the Service not less frequently than annually, with critical and high findings retested; a summary is available under Article 11. Customer shall conduct no security testing except as Article 8 permits.

14.2 Logging; Tenant Isolation; Hosting

Security-relevant logs are centrally collected, monitored for indicators of compromise, and protected against modification. Audit Logs recording Authorized User activity are append-only and are not editable by Customer Administrators or by 4StudentLives personnel through the application. The Service is multi-tenant, organized in a County / District / School hierarchy; each Customer’s data is bound to a tenant identifier enforced at the data access layer on every request, with no commingling that would prevent extraction or deletion of Customer’s data alone under Article 17. The Service is hosted on Google Cloud Platform in United States regions, identity is provided by Firebase Authentication, and Customer Data, including backups and AI processing, is stored and processed in the United States.

14.3 Security Incident Response and 72-Hour Notification

4StudentLives maintains a written incident response plan and exercises it at least annually. Upon confirming a Security Incident affecting Customer Data, 4StudentLives will notify Customer’s designated security contact without undue delay and in any event within seventy-two (72) hours of confirmation, describing, as then known, the nature of the incident, the categories of Customer Data and approximate number of records affected, the suspected root cause, remediation taken and planned, and measures Customer should take. 4StudentLives will preserve evidence and cooperate with Customer’s notification obligations under state breach notification and student data privacy statutes, including the timelines in New York Education Law § 2-d and 105 ILCS 85/. Customer determines whether notification to parents, eligible students, staff, regulators, or the public is required and makes it; 4StudentLives will not notify them directly without Customer’s written direction except where Applicable Law requires.

14.4 Frameworks; Insurance; Accessibility; No Guarantee of Absolute Security

4StudentLives’ control framework is designed with reference to the NIST Cybersecurity Framework and the control families of NIST Special Publication 800-53. 4StudentLives does not represent that the Service holds a SOC 2 attestation, an ISO/IEC 27001 certification, or a FedRAMP authorization, and Customer shall not rely on any such representation. 4StudentLives maintains commercially reasonable commercial general liability, technology errors and omissions, and cyber liability insurance and designs the Service to conform substantially to the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA, providing an Accessibility Conformance Report on request for Customer’s evaluation under Section 504 of the Rehabilitation Act of 1973 and Title II of the Americans with Disabilities Act. CUSTOMER ACKNOWLEDGES THAT NO METHOD OF TRANSMISSION OVER THE INTERNET AND NO METHOD OF ELECTRONIC STORAGE IS ONE HUNDRED PERCENT (100%) SECURE. 4STUDENTLIVES MAINTAINS THE SAFEGUARDS IN THIS ARTICLE 14 THROUGHOUT THE TERM BUT DOES NOT GUARANTEE THAT THE SERVICE OR CUSTOMER DATA WILL BE FREE FROM UNAUTHORIZED ACCESS, INTERCEPTION, ALTERATION, LOSS, OR DESTRUCTION.

ARTICLE 15. SERVICE AVAILABILITY, MAINTENANCE, AND SUPPORT

15.1 Availability; Maintenance; Support

4StudentLives will use commercially reasonable efforts to make the Service available with Uptime of at least ninety-nine and five tenths percent (99.5%) measured over each calendar month, determined from external monitoring of core authenticated endpoints, disregarding interruptions shorter than five (5) consecutive minutes, and excluding scheduled and emergency maintenance, Force Majeure Events, failures of the public internet or of Customer’s network, any Third-Party Service, acts or omissions of Customer, suspension, trial and beta features, and infrastructure-provider outages. These Terms provide no service credits; credits, if any, arise only where an Order Form so provides and are then Customer’s sole remedy for failure to meet the availability target, subject to Article 26. Routine maintenance occurs in a published weekend window on at least five (5) business days’ notice; emergency maintenance may occur at any time on notice as promptly as practicable. Support hours and target response times are stated in the Documentation; they are targets, not resolution guarantees, and are not a warranty. 4StudentLives will not materially degrade a licensed module during a paid Term and will give ninety (90) days’ notice and, at Customer’s election, a pro rata refund of prepaid unused Fees if it discontinues one.

15.2 Not an Emergency System

The Service is not an emergency notification, alerting, dispatch, or life-safety system, and its availability commitments shall not be relied upon in an emergency. Customer shall maintain independent emergency procedures that do not depend on the Service. In an emergency, call 911.

ARTICLE 16. BACKUPS AND DISASTER RECOVERY

16.1 Backups; Recovery Objectives; Testing

4StudentLives performs automated encrypted backups of the production database not less frequently than daily, with continuous transaction log capture and backups of uploaded files. Daily backups support point-in-time recovery for not less than thirty (30) days; disaster-recovery copies are overwritten or expire on a rolling cycle not to exceed twelve (12) months. For a formally declared disaster, the Recovery Point Objective (RPO) is twenty-four (24) hours and the Recovery Time Objective (RTO) is twenty-four (24) hours; these are design objectives, not guarantees. Backups are replicated across at least two geographically separated Google Cloud Platform regions or zones within the United States, and all backup copies of Customer Data remain within the United States. 4StudentLives tests restoration at least annually and maintains a written business continuity and disaster recovery plan.

16.2 Backups Are Not an Archive

Backups exist solely as a disaster-recovery mechanism. They are not an archival service, a records management system, a litigation hold repository, or a substitute for Customer’s own retention obligations, and are not available to Customer as a data source. Customer shall independently export and preserve Customer Data as required to satisfy its retention, audit, discovery, and public records obligations, and 4StudentLives has no liability for the unavailability of a record Customer failed to export.

ARTICLE 17. DATA RETENTION, EXPORT, AND DELETION

17.1 Export Window

During the Term 4StudentLives retains Customer Data for so long as Customer maintains it in the Service; deletion by an Authorized User removes a record from active production, though it may persist in backup media until expiry. Customer may export at any time during the Term and, for ninety (90) days following expiration or termination (the “Export Window”), 4StudentLives will make Customer Data available for export in commonly used, machine-readable formats at no additional charge, except that a custom-format extraction is chargeable Professional Services. Access during the Export Window is limited to export purposes. 4StudentLives will not delete Customer Data before the end of the Export Window solely because Fees are unpaid, but may condition a bulk export on payment of undisputed past-due Fees.

17.2 Deletion; Certification; Exceptions

Following the Export Window, or earlier on written request to legal@4studentlives.com, 4StudentLives will delete or de-identify Customer Data from active production systems within thirty (30) days of that request or, if none is made, within thirty (30) days of the end of the Export Window, using methods consistent with NIST Special Publication 800-88, and on request will provide a written certification of deletion; Customer may request deletion of a defined subset during the Term on the same basis. Backup media are overwritten or expire within a period not to exceed twelve (12) months, selective deletion from backup media is not performed, and Customer Data persisting on backup media remains subject to Articles 14 and 25, is used only for disaster recovery, and is not accessed except in a declared disaster recovery event or as required by law. 4StudentLives may retain Customer Data longer only where Applicable Law or valid legal process requires, notifying Customer unless prohibited. This Article survives termination until fully performed.

ARTICLE 18. ELECTRONIC COMMUNICATIONS AND EMAIL NOTIFICATIONS

18.1 Consent; Electronic Signatures; Categories

Customer consents, for itself and its Authorized Users, to receive all notices, disclosures, invoices, policy updates, and security notifications electronically, and agrees that electronic delivery satisfies any legal requirement of a writing. The parties consent to electronic signatures under the Electronic Signatures in Global and National Commerce Act, 15 U.S.C. §§ 7001 et seq. (“E-SIGN”), and the Uniform Electronic Transactions Act as enacted at Utah Code Ann. §§ 46-4-101 et seq., except where law governing Customer as a public entity requires a manual signature. Transactional and contractual communications cannot be unsubscribed from while the Agreement is in effect, though Customer Administrators may configure which notification types are enabled; marketing communications are sent only on an opt-in basis, contain a functioning unsubscribe mechanism, and comply with the CAN-SPAM Act, 15 U.S.C. §§ 7701 et seq. 4StudentLives sends no marketing communications to parents, guardians, or students.

18.2 Content Minimization; Deliverability; Notices

Email notifications are content-minimized: they state that activity has occurred or action is required and direct the recipient to log in, and contain no student names or identifiers, assessment content, risk or threat determinations, case narratives, or safety plan content. Customer shall not request inclusion of Student Data in notification content and shall maintain accurate, monitored institutional addresses; notice sent to the most recent address Customer has provided is effective when sent, whether or not received. 4StudentLives does not guarantee that any notification will be delivered, delivered promptly, or read, and disclaims liability for non-delivery; Customer shall treat the Service’s in-application task and case views as authoritative. EMAIL NOTIFICATIONS ARE NOT AN EMERGENCY ALERTING OR LIFE-SAFETY SYSTEM AND MUST NOT BE RELIED UPON TO COMMUNICATE AN IMMINENT THREAT. IN AN EMERGENCY, CALL 911. Contractual notices to 4StudentLives go to legal@4studentlives.com and, for termination or dispute, additionally by overnight courier to 1967 E Sunshine Trl, Saint George, Utah 84790-1919.

ARTICLE 19. SMS NOTIFICATIONS

19.1 Program; Consent; Frequency; Rates

4StudentLives offers an optional SMS notification program delivered through Twilio Inc., disabled by default, under which operational notifications are sent to Authorized Users whom Customer enrolls, directing them to log in for details. The program is operational and transactional only; no marketing, promotional, advertising, or fundraising messages are sent or permitted. Customer is solely responsible for obtaining and documenting any consent required under Applicable Law — including the Telephone Consumer Protection Act, 47 U.S.C. § 227, and 47 C.F.R. § 64.1200 — before enrolling any mobile number, represents that each enrolled number belongs to a consenting Authorized User, and shall indemnify 4StudentLives for claims arising from enrollment without a lawful basis as provided in Article 29. Message frequency varies. Message and data rates may apply; carrier charges are the responsibility of the recipient or Customer.

19.2 Opt-Out; Help; Delivery; Content

A recipient may opt out at any time by replying STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT to any message from the program, after which a single confirmation message is sent and no further notifications are delivered to that number unless the recipient re-enrolls; opting out does not affect access to the Service or email notifications under Article 18. A recipient may reply HELP for assistance and will receive a reply identifying the program and 4StudentLives and providing legal@4studentlives.com and 1967 E Sunshine Trl, Saint George, Utah 84790-1919. The program is supported on major United States wireless carriers, and carriers are not liable for delayed or undelivered messages; neither 4StudentLives nor Twilio guarantees delivery. SMS notifications are content-minimized on the same basis as email notifications under Article 18 and contain no Student Data. Because carriers reassign numbers, Customer shall remove an enrolled number as part of deprovisioning and is responsible for messages sent to a reassigned number it failed to remove. Enrolled numbers and delivery metadata are handled under the Privacy Policy and are used solely to deliver Service notifications and are not sold, rented, shared for marketing, or disclosed to any third party other than Twilio for delivery, except as required by law. 4StudentLives may modify or discontinue the program on reasonable notice.

19.3 SMS Is Not an Emergency Service

SMS NOTIFICATIONS ARE NOT AN EMERGENCY NOTIFICATION, ALERTING, CRISIS DISPATCH, OR LIFE-SAFETY SYSTEM. TEXT MESSAGES MAY BE DELAYED, MISDIRECTED, FILTERED, OR NEVER DELIVERED AND MUST NEVER BE RELIED UPON TO COMMUNICATE AN IMMINENT THREAT OF VIOLENCE, A SUICIDE RISK REQUIRING IMMEDIATE INTERVENTION, A MEDICAL OR PSYCHIATRIC EMERGENCY, OR ANY OTHER CIRCUMSTANCE REQUIRING IMMEDIATE RESPONSE. IN AN EMERGENCY, CALL 911. FOR SUICIDE OR MENTAL HEALTH CRISIS SUPPORT, CALL OR TEXT 988.

ARTICLE 20. FEES, PAYMENT, TAXES, AND NON-APPROPRIATION

20.1 Fees, Invoicing, Payment, and Disputes

Customer shall pay the Fees stated in the applicable Order Form. Unless the Order Form provides otherwise, the Service is licensed on an annual prepaid subscription basis, invoiced on execution for the Initial Term and no earlier than sixty (60) days before each Renewal Term. Undisputed amounts are due net thirty (30) days. If Customer in good faith disputes an invoice, it shall pay all undisputed amounts when due and give written notice to legal@4studentlives.com within twenty (20) days; disputed amounts accrue no late charge and are not grounds for suspension while pending, and amounts resolved in 4StudentLives’ favor are due within fifteen (15) days. Amounts not paid when due and not properly disputed accrue interest at the lesser of one and one-half percent (1.5%) per month and the maximum lawful rate, except that a state prompt-payment statute governing a public-entity Customer controls to the extent of a conflict. If an undisputed amount remains unpaid more than thirty (30) days after the due date, 4StudentLives may give notice of intent to suspend and, if it remains unpaid fifteen (15) days after that notice, may suspend under Article 27 until payment in full; Fees continue to accrue during suspension.

20.2 Taxes; Expenses; Renewal Adjustments; Purchase Orders

Fees are exclusive of all Taxes, for which Customer is responsible. A Customer claiming exemption shall furnish a valid exemption certificate at or before execution of the Order Form and is responsible for Taxes, interest, and penalties assessed for periods without valid documentation on file. Fees exclude travel and out-of-pocket expenses for Customer-requested on-site services, invoiced at cost. 4StudentLives may adjust Renewal Term Fees by written notice delivered at least sixty (60) days before the end of the then-current Term, which Customer may decline by giving notice of non-renewal under Article 26; fixed multi-year pricing is not adjusted during the fixed period. Where Customer’s procurement rules require a purchase order, Customer shall issue a valid one before the invoice due date, and its failure does not excuse payment. Except where these Terms expressly provide a refund, Fees are non-cancelable and non-refundable.

20.3 Non-Appropriation

Customer may be a public entity whose funding obligations extend only to funds lawfully appropriated and available for the applicable fiscal period, and nothing in the Agreement creates a debt of Customer in excess of appropriated and available funds. If Customer’s governing body or funding authority fails to appropriate sufficient funds for any fiscal period after that in which the Order Form is executed, Customer may terminate the Agreement or the affected Order Form effective at the end of the last funded fiscal period, on written notice delivered no later than thirty (30) days after the non-appropriation determination becomes final. Termination under this Section is without penalty or further liability other than Fees accrued for the funded period, and 4StudentLives will refund the prepaid, unused portion of Fees on a pro rata daily basis within forty-five (45) days. Customer shall use reasonable and lawful efforts to obtain appropriation and shall not use this Section as a substitute for termination for convenience. Article 17 and the survival provisions of Article 26 apply, including the ninety (90) day Export Window.

ARTICLE 21. COPYRIGHT POLICY AND DMCA SAFE HARBOR

21.1 Scope; Copyright Agent

This Article states 4StudentLives’ policy under the Digital Millennium Copyright Act, 17 U.S.C. § 512 (“DMCA”), for claims that material stored on the Service at the direction of a user within the meaning of 17 U.S.C. § 512(c) infringes copyright. 4StudentLives does not select, edit, or approve uploaded material and undertakes no duty to affirmatively seek facts indicating infringing activity, consistent with 17 U.S.C. § 512(m). It has designated the following agent to receive notifications of claimed infringement and registered that designation with the United States Copyright Office under 17 U.S.C. § 512(c)(2):

Copyright Agent 4StudentLives, Inc. 1967 E Sunshine Trl Saint George, Utah 84790-1919 Email: legal@4studentlives.com

21.2 Notification of Claimed Infringement

To be effective under 17 U.S.C. § 512(c)(3)(A), a written notification must be provided to the Copyright Agent and include substantially all of: (a) a physical or electronic signature of a person authorized to act on behalf of the owner of an exclusive right that is allegedly infringed; (b) identification of the copyrighted work claimed to have been infringed, or, if multiple works at a single online site are covered by a single notification, a representative list of such works at that site; (c) identification of the material claimed to be infringing and that is to be removed or access to which is to be disabled, with information reasonably sufficient to permit 4StudentLives to locate it; (d) information reasonably sufficient to permit 4StudentLives to contact the complaining party, such as an address, telephone number, and, if available, an electronic mail address; (e) a statement that the complaining party has a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law; and (f) a statement that the information in the notification is accurate, and under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly infringed. A notification failing substantially to comply with clauses (b), (c), and (d) will not be considered in determining whether 4StudentLives has actual knowledge of infringing activity, except as provided in 17 U.S.C. § 512(c)(3)(B)(ii); where a notification substantially complies but is otherwise deficient, 4StudentLives will promptly attempt to contact the complaining party.

21.3 Response; Counter-Notification; Restoration

Upon receipt of a substantially compliant notification, 4StudentLives will act expeditiously to remove or disable access to the identified material. 4StudentLives will ordinarily disable access rather than delete; quarantined material remains Customer Data under Articles 10, 11, and 25. 4StudentLives will promptly notify the affected Customer Administrator and describe the counter-notification process, and will not disclose Student Data or tenant contents to a complaining party. A counter-notification to the Copyright Agent, to be effective under 17 U.S.C. § 512(g)(3), must include substantially all of: (a) a physical or electronic signature of the subscriber; (b) identification of the material removed or disabled and the location at which it appeared before it was removed or access to it was disabled; (c) a statement under penalty of perjury that the subscriber has a good faith belief that the material was removed or disabled as a result of mistake or misidentification; and (d) the subscriber’s name, address, and telephone number, a statement consenting to the jurisdiction of the Federal District Court for the judicial district in which the address is located or, if outside the United States, any judicial district in which 4StudentLives may be found, and a statement that the subscriber will accept service of process from the person who provided the notification or that person’s agent. On receipt of a substantially compliant counter-notification, 4StudentLives will promptly provide the complaining party a copy as 17 U.S.C. § 512(g)(2) requires and inform it that access will be restored in not less than ten (10) business days, and will restore the material not less than ten (10) nor more than fourteen (14) business days after receipt unless the Copyright Agent first receives notice that the complaining party has filed an action seeking a court order to restrain the subscriber from infringing activity relating to the material.

21.4 Repeat Infringers; Misrepresentation; Fair Use

4StudentLives has adopted and reasonably implements a policy providing for the termination, in appropriate circumstances, of the access of Authorized Users who are repeat infringers, as required by 17 U.S.C. § 512(i)(1)(A). A first valid, uncontested notification results in removal and written warning to the Customer Administrator; a second adds confirmation of remedial training and temporary suspension of upload privileges; a third terminates that Authorized User’s access; and a pattern across multiple Authorized Users, or Customer’s failure to take corrective action, results in notice requiring a remediation plan within thirty (30) days and, failing that, suspension under Article 27 and termination under Article 26. A notification that is counter-notified, withdrawn, or non-compliant is not a strike, and strikes expire twenty-four (24) months after they are recorded. Under 17 U.S.C. § 512(f), any person who knowingly materially misrepresents that material or activity is infringing, or that material was removed or disabled by mistake or misidentification, shall be liable for any damages, including costs and attorneys’ fees, incurred by the alleged infringer, by any copyright owner or its authorized licensee, or by 4StudentLives as a service provider, who is injured by such misrepresentation as the result of 4StudentLives relying upon it in removing or disabling access to the material, or in replacing the removed material or ceasing to disable access to it. Submitters should include no Student Data beyond what the elements above require. Material uploaded in an educational context may be subject to fair use under 17 U.S.C. § 107, 17 U.S.C. § 110 (including the Technology, Education, and Copyright Harmonization Act, the “TEACH Act”), or 17 U.S.C. § 108; neither removal nor restoration is a determination of infringement.

ARTICLE 22. FEEDBACK

22.1 License to Feedback

Customer grants 4StudentLives a perpetual, irrevocable, worldwide, royalty-free, non-exclusive, and sublicensable license to use, reproduce, modify, and otherwise exploit any suggestion, enhancement request, bug report, or other feedback relating to the Service (“Feedback”) for any purpose without attribution or compensation. 4StudentLives has no obligation to implement any Feedback. Customer shall include no Customer Data, Student Data, or Education Records in Feedback, and this license does not extend to them.

ARTICLE 23. THIRD-PARTY SERVICES AND INTEGRATIONS

23.1 Third-Party Services

The Service is delivered using, and may interoperate with, Third-Party Services, including those identified in Article 11 and, at Customer’s election, identity providers and student information system integrations. Enabling an integration is Customer’s documented instruction to exchange with that Third-Party Service the data necessary to operate it, and Customer is solely responsible for determining whether the resulting data flows are consistent with FERPA, PPRA, and applicable state student data privacy statutes and for the scopes it shares. 4StudentLives makes no representation or warranty with respect to any Third-Party Service; a defect, outage, or change in a Third-Party Service is not a breach by 4StudentLives and is excluded from the availability calculation under Article 15. 4StudentLives may add, substitute, or discontinue an integration where necessary to maintain the security or supportability of the Service, giving as much advance notice as practicable; if that change is a material adverse modification, Article 34 applies.

23.2 Subprocessor Objection Process

Within thirty (30) days after notice of a new or expanded Subprocessor under Article 11, Customer may object by written notice to legal@4studentlives.com stating reasonable, documented grounds relating to data protection, privacy, or security. The parties shall then work in good faith for thirty (30) days to identify a commercially reasonable accommodation. If no accommodation is reached and 4StudentLives cannot provide the Service without the objected-to Subprocessor, either party may terminate the affected Order Form on thirty (30) days’ written notice and 4StudentLives will refund the prepaid, unused portion of Fees on a pro rata daily basis; that termination and refund are Customer’s exclusive remedy for an unresolved Subprocessor objection. Where 4StudentLives must replace a Subprocessor on an emergency basis, it may do so before the notice period elapses provided it gives notice as promptly as practicable and the replacement is bound by obligations no less protective.

ARTICLE 24. OPEN SOURCE SOFTWARE

24.1 Open Source Components

The Service incorporates components licensed under open source or similar publicly available licenses (“Open Source Software”). Each is licensed to Customer under the terms accompanying that component and not under Article 8, and that license controls as to that component. 4StudentLives maintains a written list of material components and their licenses, available on request to legal@4studentlives.com. Because the Service is a hosted offering, 4StudentLives does not distribute it within the meaning of those licenses, and Customer’s use triggers no copyleft obligation. Open Source Software is provided without warranty, and Article 28 applies fully to it.

ARTICLE 25. CONFIDENTIALITY

25.1 Obligations; Exclusions; Compelled Disclosure

“Confidential Information” means non-public information disclosed by one party (the “Disclosing Party”) to the other (the “Receiving Party”) that is designated confidential or that a reasonable person would understand to be confidential, including, for 4StudentLives, the Service’s non-public architecture, security controls, penetration test results, and non-public pricing, and, for Customer, all Customer Data and its non-public security configurations and investigative materials. The Receiving Party shall use Confidential Information solely to perform the Agreement, shall not otherwise disclose it, and shall protect it with at least reasonable care; it may disclose to personnel, advisors, and Subprocessors with a need to know who are bound by obligations no less protective. Confidential Information excludes information the Receiving Party can demonstrate was already known without restriction, is or becomes public through no breach, was independently developed, or was rightfully received from a third party without a duty of confidentiality; those exclusions do not apply to Student Data, Education Records, or Personal Information, which are governed by Articles 10 and 11. Where disclosure is compelled by law, the Receiving Party may disclose provided it gives prompt prior written notice to the extent legally permitted, cooperates at the Disclosing Party’s expense in seeking confidential treatment, and discloses only the portion legally required.

25.2 Public Records; Return; Duration; Equitable Relief

Customer may be a public entity subject to a state public records or freedom of information law; this Article requires Customer to withhold no record it is legally obligated to disclose. Customer shall, to the extent applicable law permits, notify legal@4studentlives.com before disclosing 4StudentLives’ Confidential Information in response to a public records request so that 4StudentLives may assert an exemption at its own expense; good-faith disclosure after that notice is not a breach. Upon expiration or termination, or earlier on written request, the Receiving Party shall return or destroy the Disclosing Party’s Confidential Information and, on request, certify destruction, except for backup copies expiring under Articles 16 and 17, retention required by law, and Customer Data handled under Article 17. Obligations continue for three (3) years after expiration or termination, except in perpetuity as to Customer Data, Student Data, Education Records, and Personal Information, and for so long as information remains a trade secret. Unauthorized disclosure may cause irreparable harm for which damages are inadequate, and the Disclosing Party may seek injunctive relief without bond, subject to the carve-out in Article 31.

ARTICLE 26. TERM, RENEWAL, AND TERMINATION

26.1 Term, Renewal, and Termination Rights

The Agreement commences on the earlier of the effective date stated in the first Order Form and the date Customer first accesses the Service and continues for the initial subscription period stated in that Order Form (the “Initial Term”), which is twelve (12) months unless the Order Form provides otherwise. Each Order Form automatically renews for successive one (1) year periods (each, a “Renewal Term”) unless either party delivers written notice of non-renewal at least thirty (30) days before the end of the then-current term, with Renewal Term Fees subject to Article 20. Either party may terminate the Agreement or the affected Order Form if the other materially breaches and fails to cure within thirty (30) days after written notice describing the breach; where a breach is capable of cure but not reasonably curable in thirty (30) days, the period extends for so long as the breaching party commences cure within it and diligently pursues it, up to sixty (60) additional days. If Customer terminates for 4StudentLives’ uncured material breach, 4StudentLives will refund the prepaid, unused portion of Fees on a pro rata daily basis within forty-five (45) days. Customer may terminate for convenience only if an Order Form expressly so provides; absent that right, Fees for the remainder of the term remain due. Either party may terminate immediately, without a cure period, on the other’s violation of the AUP or Article 8 creating an imminent risk to the security of the Service or Customer Data; insolvency or cessation of business; infringement of the terminating party’s intellectual property; or unlawful use exposing the terminating party to liability.

26.2 Effects of Termination; Survival

On expiration or termination, all licenses and access rights terminate except for export use; all accrued Fees become immediately due, subject to any refund expressly provided in these Terms; 4StudentLives will maintain Customer’s ability to export Customer Data for ninety (90) days, and will thereafter delete Customer Data, as Article 17 provides; and each party shall return or destroy the other’s Confidential Information as Article 25 provides. Articles 1, 9, 10, 11, 12, 14, 17, 20, 21, 22, 24, 25, 28, 29, 30, 31, 33, 35, 36, and 37, the order-of-precedence provisions of Article 2, and this Article survive expiration or termination, together with any other provision that by its nature is intended to survive.

ARTICLE 27. SUSPENSION OF SERVICE

27.1 Grounds, Scope, Notice, and Restoration

4StudentLives may suspend Customer’s or an Authorized User’s access, in whole or in part, where continued access presents an imminent risk to the security, confidentiality, or availability of the Service, Customer Data, or another customer’s data; Malicious Code is detected in Customer’s tenant; undisputed Fees remain unpaid after the process in Article 20; law or a governmental authority requires suspension; Customer or an Authorized User materially breaches the AUP or Article 8; or 4StudentLives reasonably suspects that credentials have been compromised or shared. 4StudentLives shall apply the narrowest suspension reasonably necessary, suspending at the account or module level rather than the tenant unless the condition is systemic; shall give written notice before suspending where practicable and otherwise within twenty-four (24) hours, except where law prohibits notice; and shall restore access within one (1) business day after the condition is cured. No credit or extension of the Term arises from a suspension caused by a condition within Customer’s control, and Fees continue to accrue.

27.2 Student-Safety Criticality

In exercising any suspension right, 4StudentLives shall work in good faith to avoid interrupting access needed for an active safety case, including by preserving read-only access to open cases or export capability. Nothing here requires 4StudentLives to maintain access where doing so would perpetuate a security compromise or violate law, and nothing here creates a duty of care to any student, parent, or guardian or makes any such person a third-party beneficiary.

ARTICLE 28. DISCLAIMERS OF WARRANTIES

28.1 Limited Express Warranties; Exclusive Remedy

4StudentLives warrants that during the Term the Service will perform materially in accordance with the Documentation; that it has full corporate power to perform the Agreement; that it will provide the Service and Professional Services in a professional and workmanlike manner; and that, to its knowledge, the Service contains no Malicious Code. Customer shall give written notice of a claimed breach of the performance warranty within thirty (30) days after becoming aware of the nonconformity. 4StudentLives’ entire liability, and Customer’s sole and exclusive remedy, is, at 4StudentLives’ option, to correct the nonconformity, to re-perform the nonconforming services, or, if neither is commercially reasonable, to terminate the affected Order Form and refund the prepaid, unused portion of Fees attributable to the nonconforming portion on a pro rata daily basis from the date of notice. The warranty does not apply to a nonconformity caused by use inconsistent with the Documentation, modification by any person other than 4StudentLives, Customer Data or Customer’s systems, a Third-Party Service under Article 23, or a Force Majeure Event.

28.2 Disclaimer of Implied Warranties

EXCEPT FOR THE EXPRESS WARRANTIES IN SECTION 28.1, THE SERVICE, THE DOCUMENTATION, THE AI FEATURES, THE AI OUTPUT, AND ALL SUPPORT AND PROFESSIONAL SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE,” AND 4STUDENTLIVES AND ITS LICENSORS DISCLAIM ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR ARISING FROM COURSE OF DEALING, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, QUIET ENJOYMENT, AND ACCURACY. 4STUDENTLIVES DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE OF DEFECTS, THAT ALL DEFECTS WILL BE CORRECTED, OR THAT IT WILL OPERATE WITH ANY PARTICULAR HARDWARE, SOFTWARE, NETWORK, OR THIRD-PARTY SERVICE. The availability target in Article 15 is a service level commitment, not a warranty. Where an exclusion is unenforceable as to a particular Customer, it applies to the maximum extent that law permits.

28.3 Clinical, Professional, and Emergency Services Disclaimer

This Section is a material term, and Customer acknowledges that 4StudentLives would not license the Service on the stated Fees without it. The Service records, organizes, stores, and retrieves information Authorized Users enter; it does not perform an assessment and does not exercise judgment. The Service is not, and is not offered as, a medical device within the meaning of 21 U.S.C. § 321(h), is not cleared, approved, or authorized by the United States Food and Drug Administration, and is not intended for use in the diagnosis, cure, mitigation, treatment, or prevention of any disease or condition. It is not a diagnostic, screening, psychometric, or validated assessment instrument. IT DOES NOT PREDICT, FORECAST, SCORE, RATE, OR ESTIMATE THE LIKELIHOOD OF VIOLENCE, SELF-HARM, SUICIDE, OR ANY OTHER OUTCOME, AND IT DOES NOT IDENTIFY INDIVIDUALS AS DANGEROUS OR AT RISK. Where a Customer configures an assessment instrument that specifies a scoring construct, the Service performs only the deterministic arithmetic that instrument prescribes on the entries Customer’s personnel make, and any threat level, risk level, tier, or classification recorded is one determined and entered by Customer’s own qualified personnel applying Customer’s adopted framework. 4StudentLives provides no clinical, medical, psychological, counseling, educational, legal, or law enforcement advice, and no professional relationship arises with any Authorized User, student, parent, or guardian. The Service is not a substitute for the professional judgment of qualified personnel, for the deliberation of a multidisciplinary threat assessment or crisis team, for a clinical evaluation, for compliance with Customer’s own policies and mandatory reporting obligations, or for consultation with counsel. THE SERVICE IS NOT AN EMERGENCY NOTIFICATION SYSTEM, AN EMERGENCY RESPONSE SYSTEM, A CRISIS HOTLINE, OR A MONITORING SERVICE. 4STUDENTLIVES DOES NOT MONITOR CUSTOMER DATA FOR INDICATIONS OF RISK. IN AN EMERGENCY, OR IF A PERSON IS IN IMMINENT DANGER OF HARM TO SELF OR OTHERS, CALL 911 OR THE 988 SUICIDE AND CRISIS LIFELINE. DO NOT RELY ON THE SERVICE TO SUMMON ASSISTANCE.

ARTICLE 29. INDEMNIFICATION

29.1 Indemnification by 4StudentLives

4StudentLives shall defend Customer and its officers, employees, and governing board members against any third-party claim alleging that the Service, as provided and used in accordance with the Agreement, infringes or misappropriates a United States patent, copyright, trademark, or trade secret (an “Infringement Claim”), and shall indemnify Customer against damages and costs finally awarded or agreed in settlement. It has no obligation to the extent the claim arises from combination with items not provided by 4StudentLives; modification by another person or at Customer’s direction; Customer Data; use in violation of the Agreement, the AUP, or applicable law; continued use of an infringing version after notice to cease; or a Third-Party Service under Article 23. If the Service becomes, or is likely to become, the subject of an Infringement Claim, 4StudentLives may at its expense procure the right to continue use, replace the affected portion with a non-infringing alternative, or, if neither is commercially reasonable, terminate the affected Order Form and refund the prepaid, unused portion of Fees. This Section states 4StudentLives’ entire liability, and Customer’s sole and exclusive remedy, for any claim of intellectual property infringement or misappropriation.

29.2 Indemnification by Customer; Procedure; Public Entity Accommodation

Subject to the accommodation below, Customer shall defend 4StudentLives and its officers, employees, and agents against any third-party claim arising out of Customer Data, including that it infringes intellectual property rights, violates privacy rights, or was collected unlawfully; breach of the AUP or Article 8; violation of applicable law, including FERPA, PPRA, and state student data privacy statutes; failure to obtain a required consent or give a required notice, including any notice required by 34 C.F.R. § 99.7; a claim by a parent, guardian, student, or employee arising out of Customer’s own decisions, assessments, interventions, disclosures, or failures to act, including any decision informed by AI Output; and submission of protected health information in violation of Article 12. The party seeking indemnification shall give prompt written notice (delay excusing the indemnifying party only to the extent of material prejudice), give it sole control of the defense and settlement (provided no settlement admits the indemnified party’s liability or fails to release it without consent), and cooperate at the indemnifying party’s expense. The parties acknowledge that Customer may be a public entity whose authority to indemnify, defend, or hold harmless a private party is limited or prohibited by its state constitution, statute, regulation, or the doctrines of sovereign or governmental immunity, and whose obligations may be further limited by statutory damages caps, claim presentation requirements, or the availability of appropriated funds. Customer’s indemnity obligations therefore apply only to the extent applicable law permits; where Customer is legally prohibited from providing a defense or indemnity, those obligations shall be construed as a covenant to be financially responsible, to the maximum extent lawful and subject to appropriation, for losses caused by Customer’s own acts or omissions; nothing in the Agreement waives any sovereign, governmental, or statutory immunity or damages limitation available to Customer, and no waiver shall be implied; and the invalidity of Customer’s indemnity does not affect any other provision.

ARTICLE 30. LIMITATION OF LIABILITY

30.1 Exclusion of Indirect Damages; Caps

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY, NOR ITS LICENSORS, SUPPLIERS, OR SUBPROCESSORS, SHALL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST BUSINESS, LOSS OF GOODWILL, BUSINESS INTERRUPTION, COST OF SUBSTITUTE SERVICES, OR LOSS, CORRUPTION, OR UNAVAILABILITY OF DATA, ARISING OUT OF THE AGREEMENT OR THE SERVICE, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, WARRANTY, STATUTE, OR OTHERWISE, AND WHETHER OR NOT ADVISED OF THE POSSIBILITY OF SUCH DAMAGES; the exclusion for loss or corruption of data does not apply to a claim arising from 4StudentLives’ breach of Article 14 or Article 25, which is subject to the super-cap below. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND EXCEPT AS PROVIDED BELOW, THE TOTAL AGGREGATE LIABILITY OF EACH PARTY ARISING OUT OF THE AGREEMENT SHALL NOT EXCEED THE GREATER OF (A) THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER UNDER THE APPLICABLE ORDER FORM IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM AND (B) ONE THOUSAND DOLLARS ($1,000). Notwithstanding that cap, 4StudentLives’ total aggregate liability for breach of Article 25, for breach of its data security obligations under Article 14 including a resulting Security Incident, and for its defense and indemnification obligations under Article 29 shall not exceed three (3) times the total Fees paid or payable by Customer under the applicable Order Form in the twelve (12) months immediately preceding the event giving rise to the claim, inclusive of and not in addition to amounts recovered under the general cap.

30.2 Exclusions from the Caps; Allocation of Risk

The foregoing limitations do not apply to Customer’s obligation to pay Fees and Taxes under Article 20; Customer’s breach of the AUP or Article 8, or its infringement of 4StudentLives’ intellectual property; Customer’s indemnification obligations for third-party intellectual property claims, which are not subject to the caps, and 4StudentLives’ obligations for Infringement Claims, which are not subject to the general cap but remain subject to the super-cap; a party’s gross negligence, willful misconduct, or fraud; and any liability that cannot be limited under applicable law. These limitations and the disclaimers in Article 28 reflect an agreed allocation of risk on which the Fees were set. THE LIMITATIONS IN THIS ARTICLE 30 APPLY EVEN IF ANY LIMITED OR EXCLUSIVE REMEDY IS FOUND TO HAVE FAILED OF ITS ESSENTIAL PURPOSE. More than one claim, Order Form, or incident does not enlarge the caps, which are aggregate; this Article applies to claims against a party’s officers, employees, agents, licensors, suppliers, and Subprocessors; and nothing here waives any immunity, damages limitation, or claim-presentation requirement available to Customer as a public entity.

ARTICLE 31. DISPUTE RESOLUTION AND BINDING ARBITRATION

PLEASE READ THIS ARTICLE CAREFULLY. IT REQUIRES ARBITRATION OF MOST DISPUTES, WAIVES THE RIGHT TO A JURY TRIAL, AND WAIVES THE RIGHT TO PARTICIPATE IN CLASS OR REPRESENTATIVE ACTIONS. IT CONTAINS AN ACCOMMODATION FOR PUBLIC ENTITY CUSTOMERS AND A THIRTY (30) DAY OPT-OUT RIGHT.

31.1 Mandatory Informal Resolution

Before commencing arbitration or litigation, the party asserting a dispute arising out of or relating to the Agreement or the Service (a “Dispute”) shall deliver written notice — to 4StudentLives at legal@4studentlives.com and to Customer’s designated administrative contact — describing the Dispute, the provisions at issue, and the relief sought. The parties shall negotiate in good faith for thirty (30) days following delivery, escalating to executives with settlement authority if unresolved at the working level within fifteen (15) days. Compliance with this Section is a condition precedent to commencing arbitration or litigation, and the applicable limitations period is tolled during that period. This Section does not apply to relief permitted by Section 31.4.

31.2 Agreement to Arbitrate; Seat; Arbitrators; Delegation

If a Dispute is not resolved under Section 31.1, it shall be resolved exclusively by final and binding arbitration and not in court, except as Sections 31.3, 31.4, 31.5, and 31.7 provide. The Agreement evidences a transaction involving interstate commerce, and the Federal Arbitration Act, 9 U.S.C. §§ 1–16, governs this Article; if held inapplicable, the Utah Uniform Arbitration Act, Utah Code Ann. §§ 78B-11-101 et seq., governs. The arbitration shall be administered by the American Arbitration Association (“AAA”) under its Commercial Arbitration Rules, as modified by this Article, which controls in the event of a conflict. The seat and legal place of the arbitration is Salt Lake City, Utah, though hearings may be held by videoconference without changing the seat. If the aggregate amount in controversy, exclusive of interest and costs, is one million dollars ($1,000,000) or less, a single arbitrator shall preside; if it exceeds one million dollars ($1,000,000), a panel of three (3) arbitrators shall preside, each party selecting one and the two selecting the chair; each arbitrator shall be a licensed attorney or retired judge with substantial experience in technology, software licensing, or data privacy. The arbitrator has exclusive authority to resolve any dispute concerning the interpretation, applicability, enforceability, unconscionability, scope, or formation of this Article, including any question of arbitrability; the sole exception is that the enforceability, validity, and scope of the class, collective, consolidated, and representative action waiver in Section 31.3 shall be determined exclusively by a court of competent jurisdiction and not by an arbitrator.

31.3 Class Action Waiver; Jury Trial Waiver

EACH PARTY AGREES THAT ANY DISPUTE SHALL BE BROUGHT SOLELY IN THAT PARTY’S INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF, CLAIMANT, OR CLASS MEMBER IN ANY PURPORTED CLASS, COLLECTIVE, CONSOLIDATED, PRIVATE ATTORNEY GENERAL, OR REPRESENTATIVE PROCEEDING. The arbitrator may not consolidate the claims of more than one party, preside over any class or representative proceeding, or award relief to or against a non-party, although claims under two or more Order Forms between the same parties may be consolidated by agreement or by order of the arbitrator. If this waiver is found unenforceable or void as to any claim or part of a claim, the agreement to arbitrate is null and void as to that claim or part only, which shall be severed and resolved in a court of competent jurisdiction under Article 33 while all other claims proceed in arbitration; in no event shall a class, collective, consolidated, or representative proceeding be arbitrated. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY IRREVOCABLY WAIVES ANY RIGHT TO TRIAL BY JURY IN ANY ACTION ARISING OUT OF OR RELATING TO THE AGREEMENT OR THE SERVICE; this waiver applies to any Dispute resolved in court and survives any determination that the agreement to arbitrate is unenforceable.

31.4 Carve-Outs

Either party may bring an individual claim in small claims court, provided it remains in that court and is within that court’s jurisdictional limits; and either party may seek injunctive or other equitable relief from a court of competent jurisdiction, without first complying with Section 31.1, with respect to actual or threatened infringement of its intellectual property rights, breach of Article 25, and unauthorized access to, use of, or disclosure of the Service or Customer Data. Seeking such relief is not a waiver of the agreement to arbitrate as to any other issue.

31.5 Thirty-Day Opt-Out

Customer may opt out of the agreement to arbitrate by written notice to legal@4studentlives.com, or by mail to Legal Department, 4StudentLives, Inc., 1967 E Sunshine Trl, Saint George, Utah 84790-1919, within thirty (30) days after the date Customer first accepts the Agreement. The notice must state Customer’s full legal name, the address and email associated with its account, the name and authority of the individual submitting it, and a clear statement that Customer elects to opt out of the arbitration agreement in Article 31. A timely opt-out applies to all Disputes, affects no other provision, including the jury trial waiver, the class action waiver, the limitations period, and Article 33, and is not a ground for 4StudentLives to terminate or refuse service.

31.6 Fees; Award; Confidentiality; Discovery; One-Year Limitations Period

Administrative fees and arbitrator compensation shall be allocated under the AAA rules, provided the parties bear those costs equally unless the arbitrator determines a different allocation is warranted; each party bears its own attorneys’ fees, except that the arbitrator may award fees to the prevailing party where law or the Agreement authorizes it. The arbitrator shall issue a written award stating the essential findings of fact and conclusions of law, may award any relief available in court subject to Article 30, and may not award relief inconsistent with the Agreement; judgment may be entered in any court of competent jurisdiction. The existence and content of the arbitration and the award are confidential and shall not be disclosed except as necessary to conduct the arbitration, to counsel and insurers under confidentiality obligations, to enforce or challenge the award, or as law requires, including a public records law applicable to Customer, in which case Article 25 applies; the arbitrator shall enter a protective order governing Student Data, Education Records, and other Personal Information, and the parties shall use pseudonyms in place of student names wherever practicable. Discovery shall be proportionate, and absent agreement each party may take no more than five (5) depositions, serve no more than twenty-five (25) requests for production and fifteen (15) interrogatories, and produce electronically stored information from no more than eight (8) custodians. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, ANY DISPUTE MUST BE COMMENCED, WHETHER IN ARBITRATION OR IN COURT, WITHIN ONE (1) YEAR AFTER THE CLAIMING PARTY FIRST KNEW OR REASONABLY SHOULD HAVE KNOWN OF THE FACTS GIVING RISE TO IT, AND ANY DISPUTE NOT SO COMMENCED IS PERMANENTLY BARRED, except as to a claim for non-payment of Fees, a claim for indemnification under Article 29, and a Customer whose applicable law prohibits contractual shortening of a limitations period; the period is tolled during informal resolution.

31.7 Public Entity Accommodation; Severability

The parties acknowledge that Customer may be a public entity that, as a matter of its state constitution, statute, regulation, charter, or established policy, lacks the legal capacity to agree to binding arbitration, to a forum outside its own state, or to submit claims to a private tribunal. Where that is the case, Sections 31.2 and 31.6 (other than the limitations period) do not apply to that Customer, and Disputes shall be resolved in a court of competent jurisdiction under Article 33 as modified by the public-entity accommodation in that Article. The condition precedent of informal resolution, the class and representative action waiver, the jury trial waiver, the confidentiality obligations of Article 25 as applied to litigation materials, and the one-year limitations period continue to apply to that Customer to the maximum extent applicable law permits. Except as to the non-severable class waiver in Section 31.3, if any provision of this Article is found unenforceable it shall be severed and the remainder shall remain in full force.

ARTICLE 32. FORCE MAJEURE

32.1 Definition; Effect; Notice; Termination; Carve-Outs

A “Force Majeure Event” means any event beyond the reasonable control of the affected party that could not have been avoided by reasonable diligence, including natural disaster and severe weather; pandemic and declared public health emergency; act or order of government, including school closures; war, terrorism, and civil unrest; labor dispute, excluding one limited to the affected party’s own workforce; embargo and sanction; cyberattack, including denial-of-service, ransomware, and supply-chain compromise, in each case not resulting from the affected party’s failure to maintain the safeguards the Agreement requires; failure of the public internet; and failure of an upstream cloud, hosting, telecommunications, power, or utility provider. Neither party is liable for any delay or failure of performance to the extent caused by a Force Majeure Event; performance is suspended, not excused, for its duration, and the affected party shall give written notice within five (5) business days and shall use commercially reasonable efforts to mitigate and to resume performance, prioritizing the modules most critical to active student-safety casework. If a Force Majeure Event materially prevents 4StudentLives from providing the Service for thirty (30) consecutive days or more, either party may terminate the affected Order Form on written notice delivered while the event continues, and 4StudentLives will refund the prepaid, unused portion of Fees on a pro rata daily basis from the first day of interruption within forty-five (45) days. A Force Majeure Event does not excuse Customer’s obligation to pay Fees for Service already rendered, either party’s obligation to maintain the safeguards Article 14 requires, or 4StudentLives’ obligation to notify Customer of a Security Incident within the period Article 14 states; a cyberattack that succeeds because required safeguards were not maintained is not within this Article.

ARTICLE 33. GOVERNING LAW AND VENUE

33.1 Governing Law; Excluded Bodies of Law; Venue

The Agreement and any Dispute arising out of or relating to it or the Service are governed by the laws of the State of Utah, without regard to conflict-of-laws principles, except that this Section does not displace federal law where federal law governs, including FERPA and the Federal Arbitration Act. The Uniform Computer Information Transactions Act and the United Nations Convention on Contracts for the International Sale of Goods are expressly excluded, while the Uniform Electronic Transactions Act, Utah Code Ann. §§ 46-4-101 et seq., and the Electronic Signatures in Global and National Commerce Act, 15 U.S.C. §§ 7001 et seq., apply to execution and delivery. For any Dispute not subject to arbitration under Article 31, exclusive venue lies in the state courts of Washington County, Utah, and in the United States District Court for the District of Utah, and each party consents to personal jurisdiction there.

33.2 Public Entity Accommodation

The parties acknowledge that Customer may be a public entity required by its own state constitution, statute, regulation, or charter to apply the law of its home state or to litigate in a court of its home state, and that such a requirement may not lawfully be waived by Customer’s officers. Where that is the case, Section 33.1 does not apply to that Customer to the extent of the conflict, and the parties shall address the applicable governing law and forum in the Order Form or a written addendum; absent such a provision, the governing law and forum shall be those the law of Customer’s home state requires. All other provisions remain in full force, and the excluded bodies of law remain excluded regardless of which state’s law governs.

ARTICLE 34. MODIFICATIONS TO THE AGREEMENT

34.1 Modifications; Termination for Material Adverse Modification

4StudentLives may modify these Terms, the Privacy Policy, the AUP, and the AI Policy to reflect changes in the Service, in law, or in its business. For any modification that materially affects Customer’s rights or obligations, 4StudentLives will provide at least thirty (30) days’ advance notice by email to Customer’s designated administrative contact and by posting the revised document with a new version number and effective date. A modification may take effect immediately where required to comply with law or where reasonably necessary to address a security exigency, in which case 4StudentLives will give notice as promptly as practicable. If a modification is materially adverse to Customer, Customer may terminate the affected Order Form without penalty by written notice to legal@4studentlives.com within thirty (30) days after the later of the date notice is given and the effective date of the modification, and 4StudentLives will refund the prepaid, unused portion of Fees on a pro rata daily basis within forty-five (45) days; this is Customer’s exclusive remedy for a material adverse modification. Continued access after the effective date, without timely termination notice, constitutes acceptance.

34.2 Version Archive; Negotiated Documents

4StudentLives maintains an archive of prior versions of these Terms and the incorporated policies, available on request to legal@4studentlives.com; the version in effect at the time of the conduct at issue governs it. 4StudentLives may not unilaterally modify an executed Order Form, an executed Data Privacy Agreement, or any other individually negotiated document signed by both parties, which may be amended only in a writing signed by both parties; where a modification conflicts with such a document, the negotiated document controls under Article 2.

ARTICLE 35. GENERAL PROVISIONS

35.1 Assignment; Notices; Relationship; Third-Party Beneficiaries; Publicity

Neither party may assign the Agreement without the other’s prior written consent, not to be unreasonably withheld, except that either may assign it in its entirety, without consent, to a successor by merger, change of control, or sale of all or substantially all assets, provided the assigning party gives written notice within thirty (30) days and, on assignment by 4StudentLives, the assignee assumes in writing all obligations under Articles 10, 11, 14, 17, and 25 and any executed Data Privacy Agreement; if it does not, Customer may terminate on written notice and receive a pro rata refund of prepaid, unused Fees. Any purported assignment in violation of this Section is void. Notices shall be in writing and delivered by personal delivery, overnight courier, certified mail, or, where permitted, email to the addresses in Article 37, and are deemed received on personal delivery, one (1) business day after deposit with a courier, three (3) business days after mailing, or, for email, on transmission absent a non-delivery message. The parties are independent contractors, and nothing creates a partnership, joint venture, agency, fiduciary, or employment relationship; 4StudentLives’ status as a school official under 34 C.F.R. § 99.31(a)(1)(i)(B) is a FERPA designation only. Students, parents, and guardians are not third-party beneficiaries, and nothing in the Agreement creates any right of action by a student, parent, or guardian against 4StudentLives, their rights under FERPA, 20 U.S.C. § 1232g, and comparable state law being administered by Customer. Neither party shall use the other’s name or marks publicly without prior written consent, except as law requires, including disclosure required of Customer under a public records law.

35.2 Export Control; U.S. Government End Users; Anti-Corruption; Severability; Waiver

The Service may be subject to United States export control laws, including the Export Administration Regulations, 15 C.F.R. Parts 730–774, and to sanctions administered by the U.S. Department of the Treasury’s Office of Foreign Assets Control; Customer represents that it is not located in a comprehensively sanctioned country, is not on any United States government restricted-party list, and will not provision an account to a restricted party. The Service and Documentation are “commercial products,” “commercial computer software,” and “commercial computer software documentation” as used in 48 C.F.R. § 2.101 and 48 C.F.R. § 12.212; consistent with 48 C.F.R. § 12.212 and 48 C.F.R. §§ 227.7202-1 through 227.7202-4, if acquired by or on behalf of an agency of the United States Government the Government acquires only the rights granted to all other end users, and all such rights are restricted rights. Each party shall comply with applicable anti-corruption laws, including the Foreign Corrupt Practices Act, 15 U.S.C. §§ 78dd-1 et seq., and applicable state ethics, gift, and procurement integrity laws; breach is a material breach for purposes of Article 26. If any provision is held invalid or unenforceable, it shall be reformed to the greatest extent permitted and, if reformation is impossible, severed, with the remainder continuing in full force, subject to the non-severability of the class waiver in Article 31. No failure or delay in exercising a right operates as a waiver, a waiver is effective only if in writing and signed, and acceptance of a late or partial payment waives no amount due. This Article survives expiration or termination.

ARTICLE 36. ENTIRE AGREEMENT

36.1 Entire Agreement; Non-Reliance; Amendment

The Agreement constitutes the entire and exclusive agreement between the parties with respect to its subject matter and supersedes all prior and contemporaneous proposals, requests for proposal and responses, demonstrations, pilot arrangements, marketing materials, and negotiations, whether written or oral; provided that a written representation in 4StudentLives’ response to a request for proposal is binding to the extent expressly incorporated into an executed Order Form. Each party acknowledges that it has not relied on any statement, representation, warranty, or roadmap other than those expressly set out in the Agreement, which does not limit liability for fraud. Except as Article 34 permits, the Agreement may be amended only by a written instrument signed by an authorized representative of each party, and no course of dealing, oral statement, support ticket, or preprinted term on a purchase order or click-through screen amends it.

ARTICLE 37. CONTACT INFORMATION

37.1 Contacts; Responsible Disclosure; Escalation

Questions, notices, and requests relating to the Agreement or the Service should be directed as follows.

4StudentLives welcomes reports of suspected security vulnerabilities at legal@4studentlives.com, will acknowledge a report within five (5) business days, and will not initiate legal action against a researcher who reports privately in good faith, limits testing to his or her own accounts, does not access or destroy Customer Data, and allows a reasonable period for remediation before public disclosure; this does not authorize testing of Third-Party Services, social engineering, or denial-of-service testing. A matter not resolved to Customer’s satisfaction may be escalated by written notice to the Legal Department marked “Escalation,” which does not substitute for or toll the notice of dispute requirement in Article 31.

4StudentLives, Inc. · Terms of Service · Version 1.0 · Effective Date: August 11, 2026